Alertas de Seguridad de la Información

M Alto vulnerabilidad

07/09/2026

[CVE-2026-18453] A flaw was found in 389 Directory Server. A missing NULL pointer check in the paged results handling…

A flaw was found in 389 Directory Server. A missing NULL pointer check in the paged results handling of op_shared_search allows an unauthenticated remote attacker to crash the LDAP server by sending a crafted sequence of search requests using the USE_ONE_BACKEND control, resulting in denial of service.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

07/09/2026

[CVE-2026-18922] A flaw was found in 389 Directory Server. During SASL PLAIN authentication, a stale identity carried…

A flaw was found in 389 Directory Server. During SASL PLAIN authentication, a stale identity carried in a Cyrus SASL auxiliary property from a prior failed bind attempt can be installed on a connection following a subsequent, unrelated successful bind, regardless of which SASL mechanism completes that second bind. An attacker can send a SASL PLAIN bind as cn=Directory Manager with an incorrect pas…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

07/09/2026

[CVE-2026-19843] A flaw was found in 389-ds-base. The Cockpit 389 Console's LDAP editor constructs an ldapsearch comm…

A flaw was found in 389-ds-base. The Cockpit 389 Console's LDAP editor constructs an ldapsearch command by embedding an LDAP entry's distinguished name (DN) into a shell command string without proper escaping. An LDAP user with delegated privileges to create or rename directory entries could craft a malicious DN containing shell metacharacters. When a Cockpit administrator subsequently views the e…

nvdaltovulnerabilidad CVSS 8.4 NVD

M Alto vulnerabilidad

07/09/2026

[CVE-2026-86435] commonmark versions from 1.5.0 before 2.8.4 contain a denial of service vulnerability in the Footnot…

commonmark versions from 1.5.0 before 2.8.4 contain a denial of service vulnerability in the Footnote extension that fails to deduplicate footnote definitions. Attackers can craft documents with duplicate footnote definitions and references to create quadratic output expansion, consuming excessive memory and CPU to exhaust server resources.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

07/09/2026

[CVE-2026-86428] commonmark versions from 1.5.0 before 2.10.0 contain a denial of service vulnerability in the Attrib…

commonmark versions from 1.5.0 before 2.10.0 contain a denial of service vulnerability in the AttributesExtension when processing distinctly-named attributes. Attackers can submit Markdown with numerous distinct attribute names to cause quadratic-time attribute merging and filtering, consuming disproportionate CPU resources and preventing legitimate requests from completing.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

07/09/2026

[CVE-2026-86430] league/commonmark versions before 2.9.1 contain multiple denial of service vulnerabilities in fenced…

league/commonmark versions before 2.9.1 contain multiple denial of service vulnerabilities in fenced code block detection, reference link label lookup, and emphasis delimiter processing that perform super-linear work on crafted input. Attackers can submit specially crafted Markdown with long backtick runs, nested brackets, or delimiter sequences to consume disproportionate CPU time and prevent leg…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

07/09/2026

[CVE-2026-86433] commonmark versions from 1.5.0 before 2.8.4 contain a denial of service vulnerability in the Attribu…

commonmark versions from 1.5.0 before 2.8.4 contain a denial of service vulnerability in the Attributes extension where AttributesListener::findTargetAndDirection() performs quadratic-time sibling list scanning. Unauthenticated attackers can submit approximately 32 KB of repeated attribute blocks to cause parsing to take over 5 seconds, exhausting server resources.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

07/09/2026

[CVE-2026-86434] league/commonmark versions >= 2.0.0 and < 2.8.4 (patched in 2.9.0) contain a denial of service vulne…

league/commonmark versions >= 2.0.0 and < 2.8.4 (patched in 2.9.0) contain a denial of service vulnerability in UniqueSlugNormalizer::normalize(), which restarts its numeric-suffix search from 1 on every slug collision, resulting in O(K^2) time complexity for K headings that collapse to the same base slug. The vulnerable path is reached when HeadingPermalinkExtension, FootnoteExtension, or TableOf…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

07/09/2026

[CVE-2026-80135] Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5…

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Check or Handling of Exceptional Conditions vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to protection mechanism bypass.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

07/09/2026

[CVE-2026-80238] Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5…

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Execution with Unnecessary Privileges vulnerability. An unauthenticated attacker with local access could potentially exploit this vulnerability, leading to Protection mechanism bypass. This vulnerability is considered critical because a low-privileged operator with SSH access …

nvdcriticovulnerabilidad CVSS 9.3 NVD

M Alto vulnerabilidad

07/09/2026

[CVE-2026-86303] A vulnerability was determined in 92181 markdown up to 058cab0cb7fb245a0ccc6b8446963ff8d573558f. Aff…

A vulnerability was determined in 92181 markdown up to 058cab0cb7fb245a0ccc6b8446963ff8d573558f. Affected by this issue is the function lds of the file md.c. Executing a manipulation can lead to out-of-bounds read. The attack can be executed remotely. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. Thi…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

07/09/2026

[CVE-2026-86305] A security flaw has been discovered in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf4…

A security flaw has been discovered in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930. Affected by this issue is the function Upload::upload of the file ThinkPHP/Library/Think/Upload.class.php. Performing a manipulation results in unrestricted upload. The attack is possible to be carried out remotely. The exploit has been released to the public and …

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

07/09/2026

[CVE-2026-86306] A weakness has been identified in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601…

A weakness has been identified in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930. This affects an unknown part of the file App/Home/Model/UserModel.class.php of the component Cookie Helper. Executing a manipulation of the argument Username can lead to improper authentication. The attack may be performed from remote. The exploit has been made availab…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

07/09/2026

[CVE-2026-79678] A flaw was found in FreeIPA's idp-add command, where insufficiently validated --organization/--base-…

A flaw was found in FreeIPA's idp-add command, where insufficiently validated --organization/--base-url input reaches a constrained eval() call before the corresponding LDAP access control check is enforced. This allows any authenticated IPA principal, regardless of privilege level, to enumerate and read the environment variables of the affected server process and to cause denial of service via me…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

07/09/2026

[CVE-2026-6431] The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugi…

The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Biographical Info' meta field parameter in all versions up to, and including, 3.15.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts …

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

07/09/2026

[CVE-2022-51017] PocketMine-MP versions before 3.26.5 and 4.0.5 fail to validate the length of skin data fields submi…

PocketMine-MP versions before 3.26.5 and 4.0.5 fail to validate the length of skin data fields submitted by players, allowing uncapped values to exceed the 32767 byte TAG_String limit. Attackers can submit oversized skin data fields like skinID or geometryName to trigger exceptions during NBT data serialization, causing server crashes.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

07/09/2026

Inyección de comandos OS crítica en Linksys RE7000 2.0.15 permite ejecución remota

Se ha identificado una vulnerabilidad crítica (CVSS 9.9) en el repetidor inalámbrico Linksys RE7000 versión 2.0.15. Un atacante remoto puede inyectar comandos del sistema operativo manipulando parámetros de prueba ping (pingTestIp, pingTestPktSize, pingTestTimes) en el componente /cgi-bin/json.cgi?PingTest. El exploit es público y activamente explotado, afectando infraestructuras de redes corporativas y MiPyMEs en México y Latinoamérica que dependan de este dispositivo.

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Alto vulnerabilidad

07/09/2026

Vulnerabilidad de autenticación impropia en Tenda AC9 15.03.05.14 (CVE-2026-86300)

Se identificó un fallo en el manejador R7WebsSecurityHandler del componente de gestión web en routers Tenda AC9 versión 15.03.05.14 que permite eludir autenticación de forma remota. Esta vulnerabilidad de CVSS 7.3 afecta principalmente a pequeñas y medianas empresas en LATAM que utilizan estos dispositivos en redes corporativas. El exploit ya está público, aumentando significativamente el riesgo de explotación.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

07/09/2026

Vulnerabilidad alta en Artemis de EAP: deserialización insegura por defecto

EAP's Artemis permite deserialización de objetos sin validación de seguridad por defecto, exponiendo servidores a ejecución remota de código malicioso. El método ObjectMessage.getObject() utiliza ObjectInputStreamWithClassLoader con listas de permitidos/bloqueados vacías, lo que acepta cualquier clase. Empresas en LATAM con infraestructura Java en producción enfrentan riesgo alta de compromiso de sistemas.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

07/09/2026

Vulnerabilidad alta de inyección de comandos en router D-Link DIR-895L A1_102b07

Se identificó una vulnerabilidad de inyección de comandos (CVSS 8.3) en el componente udhcpcd del router D-Link DIR-895L modelo A1_102b07, explotable remotamente a través de la manipulación del parámetro Hostname. El exploit público ya está disponible, aumentando el riesgo de compromiso de equipos de red corporativos y PYMES en LATAM que utilizan este modelo para conectividad alta.

nvdaltovulnerabilidad CVSS 8.3 NVD